      ::post-totp-code
      (-> (fn [req]
            (let [totp-code (-> req :form-params (get "code"))
-                 secret (get-session-value req "session-id" (:session-store this) :totp-secret)
+                 secret (get-session-value req SESSION-ID (:session-store this) :totp-secret)
                  ]
              (if (= totp-code (totp-token secret))
                ;; Success, set up the exchange
-               (let [session (get-session (:session-store this) (get-cookie-value req "session-id"))
+               (let [session (get-session (:session-store this) (get-cookie-value req SESSION-ID))
                      client-id (get session :client-id)
                      _ (infof "Looking up app with client-id %s yields %s" client-id (lookup-client+ (:client-registry this) client-id))
                      {:keys [callback-uri] :as client}

           (let [params (-> req :form-params)
                 identity (get params "user")
                 password (get params "password")
                 client-id (get-session-value req  "session-id" (:session-store this) :client-id)
                 scope (get-session-value req  "session-id" (:session-store this) :scope)
                 state (get-session-value req  "session-id" (:session-store this) :state)
                 scopes (set (str/split scope #"[\s]+"))
                 ;; Lookup client
                 {:keys [callback-uri] :as application}
                 (lookup-client+ (:client-registry this) client-id)]

        (if-let [session
                 (get-session
                  (:session-store this)
                  (-> req cookies-request :cookies (get SESSION-ID) :value))]
          ;; TODO Obey the 'prompt' value in OpenID/Connect
          (do
            (infof "Hi - it appears you're already logged in, session is %s" (pr-str session))
